diff options
| author | Old-Ding <[email protected]> | 2026-07-06 09:15:40 +0800 |
|---|---|---|
| committer | Rbb666 <[email protected]> | 2026-07-08 13:38:32 +0800 |
| commit | 965fc8e99291a50f3f7c92bb3e877ccfbc617b53 (patch) | |
| tree | d8d66cc48dad93943bf2eccf0ffdeade0fcc968b | |
| parent | 221502ade053e5e9142da8a6b2c0f91f32e356b4 (diff) | |
bsp: nxp: Bound VGLite buffer reader access
Check the buffer limits before reading ptr[i] in bufferred_fgets(). Also guard CR/LF skipping against the available input bytes so reading a full buffer does not inspect one byte past the source.
Generated-by: OpenAI Codex
Signed-off-by: Old-Ding <[email protected]>
| -rw-r--r-- | bsp/nxp/imx/imxrt/libraries/drivers/vglite/font/buf_reader.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/bsp/nxp/imx/imxrt/libraries/drivers/vglite/font/buf_reader.c b/bsp/nxp/imx/imxrt/libraries/drivers/vglite/font/buf_reader.c index 7fa832c6f5..d9d48ee826 100644 --- a/bsp/nxp/imx/imxrt/libraries/drivers/vglite/font/buf_reader.c +++ b/bsp/nxp/imx/imxrt/libraries/drivers/vglite/font/buf_reader.c @@ -190,7 +190,7 @@ char *bufferred_fgets(char* buff, int len, bufferred_reader_t *fd) return NULL; ptr = fd->data_buf + fd->index; - for(i=0; ptr[i] != '\0' && i < len; i++) + for(i=0; i < len && ptr[i] != '\0'; i++) { if ( ptr[i] == '\n' ) break; @@ -201,9 +201,9 @@ char *bufferred_fgets(char* buff, int len, bufferred_reader_t *fd) buff[i] = '\0'; j = i; /* skip trailing newline from file buffer */ - if ( ptr[i] == '\r' ) + if ( i < valid_bytes && ptr[i] == '\r' ) i++; - if ( ptr[i] == '\n' ) + if ( i < valid_bytes && ptr[i] == '\n' ) i++; fd->index += i; |